Businesses and other entities often make use of datacenters to provide a variety of computing resources. Increasingly, those resources are being virtualized. Such virtualization can provide benefits, such as efficient scalability and redundancy benefits. Unfortunately, such virtualization can also make it more difficult to detect and mitigate intruders (and other nefarious individuals). As one example, while the dynamic nature of modern datacenters provides flexibility, it also increases the complexity of collecting, analyzing, and surfacing information about datacenter operations. Such complexity is exasperated as data volume increases.